This Data Privacy Notice describes the practices of ComPsych Corporation, including its affiliate
ComPsych International, Inc., (collectively “Company”, “ComPsych”, “we”, or “our”) with respect to the
collection, use, storage, and disclosure (“processing”) of Personal Data covered by the Switzerland’s
Federal Act on Data Protection (“FADP”), about customers or potential customers in Switzerland when
interacting with Company related to services provided in-country by ComPsych’s Global Partner (Movis
AG), and web-based services which are provided from and hosted in the United States. In this Notice, all
the services in relation to our employee assistance programs are collectively referred to as “Services”.
Please also see our Data Privacy Framework Policy and Privacy and Terms of Use for additional
information related to data privacy.

“Personal Data,” as used in this Notice, means any information that can be used to identify you, whether
directly or indirectly, including by reference to an identifier such as a name, an identification number,
location data, an online identifier or to one or more factors specific to your physical, physiological, mental, economic, cultural or social identity.

ComPsych and Movis AG are the controllers of your Personal Data in relation with the processing
activities described in this Notice.

ComPsych Corporation is the controller of data collected from those who contact us using ComPsych’s
website. Please direct any questions or comments about this Notice, our handling of Personal Data or to
exercise your rights to:

ComPsych Corporation
455 N. Cityfront Plaza Drive, 13th Floor
Chicago, IL 60611
USA
[email protected]

Our Global Partner providing services in Switzerland, Movis AG, is the controller of data collected during
service provision in Switzerland. Please direct any questions or comments about Movis AG’s handling of
Personal Data or to exercise your rights to:
Movis AG
Kreuzstrasse 26
8008 Zurich
Tel.: +41 848 270 270
[email protected]

Questions or Complaints
Our Company welcomes communication from you related to this Notice, your rights and any comments
or complaints you may have related to the privacy of the Personal Data we process about you. If you are
not satisfied with our response or believe that we are not processing your data in accordance with the
law, you may file a complaint with the data protection authority in Switzerland at any time.

The Federal Data Protection and Information Commissioner (FDPIC), is the Swiss authority for data
protection issues (https://www.edoeb.admin.ch). We would, however, appreciate the chance to address
your concerns before you approach the FDPIC.

Purposes, Legal Bases and Data Types of the Information We Process About You
We process your Personal Data, which we collect from you directly and indirectly when you inquire about,
access, and use Company’s Services, and indirectly from third parties, such as your employer, for the
purposes set out below. If you do not provide us with Personal Data when registering for Services, we
may not be able to offer Services to you.

Purpose of Processing	Categories of Personal Data	Corresponding Legal Basis
To provide you with the information and Services offered by our Employee Assistance Programs, including our library of wellness resources, our “Guide Me” capability, our “Assess Me” capability and to connect you with health care providers where requested via the “Connect Me” capability	Name Contact details Username Password Information about your employer Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	This is necessary for us to fulfil our contracts with your employer Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To provide you with a personalized experience when using ComPsych Products and Services	Name Contact details Username Information about your employer Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	It is our legitimate business interest to provide you with a personalized experience Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To assess and improve the quality of ComPsych Products and Services, including to assess product use, completion rates and other internal business aspects, as well as the quality of our website. For example to assess how to improve website navigation and user interfaces, to assess what Products and Services are best meeting user interests, and to troubleshoot identified issues.	Username Information about your employer Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	It is our legitimate business interest to further develop and improve our Products and Services, including through understanding your use of our Products and Services, amongst others by means of our website Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To provide customers with reports on usage rates, trends and outcomes, based on aggregated data	Information you provide on your health and wellbeing Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	It is our legitimate business interest to provide (potential) customers with information about the value of our Products and Services Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To provide customer friendly Products and Services, including to address security, health and safety concerns and to provide technical support	Name Contact details Username Password Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	It is our legitimate business interest to answer your questions and requests, and to provide you with a good (support) experience when using our Products and Services Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To pursue business-related purposes, including to investigate, prevent or take action regarding (suspected) illegal activities, safety concerns, or violations of ComPsych polices, in the context of any litigation, the planning and implementing of potential mergers and acquisitions and the resolving of billing disputes with customers	Name Contact details Information about your employer Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	It is our legitimate business interest to pursue certain business-related purposes, including to ensure that our platform is safe and secure, that we can maintain our business and financial administration and to further develop Company Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health
To comply with our legal obligations under applicable laws and regulations, including with our governmental reporting and tax requirements	Name Contact details Information about your employer Information you provide on your health and wellbeing Inferences regarding your characteristics Information collected automatically when you access our websites, such as your IP address and internet or other electronic network activity information	This processing is necessary for our compliance with our legal obligations Where required by applicable laws we will ask for your (explicit) consent, for instance when we process information regarding your health

For the processing of information you provide on your health and wellbeing and inferences regarding your characteristics (“Special Category Personal Data”) we will rely on your “explicit consent” where required by applicable law.

Insofar as we process your Personal Data based on our legitimate interests, you have the right to object
if there are reasons arising from your particular situation.

Where required by applicable law, we process (Special Category) Personal Data on the basis of your
(explicit) consent, as provided by you by your affirmative action in the form of clicking a checkbox or other form of (explicit) consent. When we process your (Special Category) Personal Data on the basis of your (explicit) consent, you may withdraw that (explicit) consent at any time by contacting our Privacy Official.

Such withdrawal of consent will not affect the lawfulness of processing conducted before the time of
withdrawal If you withdraw your consent, we may still be required to process your (Special Category)
Personal Data to comply with applicable laws, but we will explain to you at the time your consent is
withdrawn what processing activities will continue for legal compliance purposes.

You may obtain additional information about the processing of your Personal Data, including Special
Category Personal Data, processed while using ComPsych’s website by contacting ComPsych’s Privacy
Official at [email protected]. For services provided in Switzerland, you may obtain additional
information about the processing of your Personal Data, including Special Category Personal Data, by
contacting Movis AG at [email protected].

We may also deidentify or anonymize your information in such a way that you may not reasonably be reidentified by us or another party, and we may use this deidentified data for the purpose of providing
customers with reports on usage rates, trends and outcomes, based on aggregated data as described
above To the extent we deidentify any data originally based on (Special Category) Personal Data we will
maintain and use such information in deidentified form and will not attempt to reidentify the data.

Recipients of Your Personal Data
Your Personal Data will be received and processed by Company. We may also disclose the Personal Data
described above in order to fulfil our obligations and in our legitimate interests above as follows:

• Business Transfers. If (i) we are or may be acquired by, merged with, or invested in by another
  company, or (ii) if any of our assets are or may be transferred to another company, whether as part
  of a divestiture, bankruptcy or insolvency proceeding or otherwise, we may transfer the
  information we have collected about you to the other company. As part of the business transfer
  process, we may disclose certain Personal Data with lenders, auditors, and third party advisors,
  including attorneys and consultants. This applies to the extent we have legitimate interests to do
  so.
• Where Legally Required. We may disclose your Personal Data with public authorities, justice and
  law enforcement, fiscal authorities and other authorities assigned with investigative powers or
  public authority, to the extent we are legally required or have legitimate interests to do so.
  
• To Protect Us and Others. We disclose your Personal Data where we believe it is appropriate to
  do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations
  involving potential threats to the safety of any person, violations of ComPsych policies, or as
  evidence in litigation in which we are involved, to the extent we have legitimate interests to do so.
  
• Service providers. We may also share your Personal Data with third party service providers such
  as, for example, without limitation, cloud providers. Such providers will process the data
  exclusively for the provision of the services related to the development of the activities of the
  Company.
  
• Other members of the ComPsych Group. We will share certain information about you with other
  ComPsych Group companies for internal administrative purposes, and insofar as it is reasonably
  necessary for the purposes stated in this Notice and relying on the corresponding legal basis.
  
• Health and wellness experts. We will share certain information about you (mainly your name and
  contact details) with those health and wellness experts with whom you request that we schedule
  an appointment and/or put you in contact with.
  
• Aggregate and De-Identified Information. We may disclose aggregate, anonymized, or deidentified information about you for the purpose of providing customers with reports on usage rates, trends and outcomes, based on aggregated data as described above, to the extent as
  permitted under applicable local law.
  
• Consent. We may also disclose your Personal Data with your (explicit) consent, where permitted
  by applicable local law

Retention
Your Personal Data will be retained only in an identifiable form for the duration of your interaction with
our Services, unless a shorter retention period is required by applicable laws or the Personal Data is no
longer necessary for the purposes for which it was obtained.

If you no longer interact with our Services, we will only retain your Personal Data for as long as it is needed to:

• fulfill Company’s legal obligations, including where retention is required as a matter of law;
  
• initiate, investigate or defend against legal claims;
  
• address your questions, requests or complaints;
  
• keep our records for analysis and audit purposes
  

If your Personal Data is processed on the basis of your (explicit) consent, Company will only use your
Personal Data until you withdraw your consent, or for as long as required to fulfill the purposes set out in
this Notice.

Data Subject Rights
You have the right to the following information regarding Company’s processing of your Personal Data:

• the purposes of the processing,
  
• the categories of Personal Data collected,
  
• the recipients or categories of recipients to whom the Personal Data has been or will be disclosed,
  
• where possible, the predicted period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period
  

This Notice is intended to provide this information. Any questions about these details may be directed to the Privacy Official as indicated in the Notice.

You may also have the following additional rights with respect to your Personal Data processed by Company:

• The right to access to the Personal Data that Company holds about you
  
• The right to rectify any of your Personal Data that is inaccurate
  
• The right to data portability
  
• The right to object to the processing of your Personal Data, to the extent we process your Personal Data on the basis of a legitimate interest The right to erasure of your Personal Data The right to restriction of processing of your Personal Data
  
• The right to withdraw consent to the processing of your Personal Data where consent is the legal basis for such processing
  
• The right to lodge a complaint with the supervisory authority for the country or state where you live or work or where you believe that your rights have been violated
  
• Company does not operate any automated decision-making systems within the meaning of Article 21 of the FADP, so the right to opt-out of such is not applicable

These rights may be subject to certain limitations or restrictions as allowed or imposed by applicable laws.
If this is the case, we will let you know in our communications with you.

To exercise your rights or for additional information related to your rights, contact ComPsych’s Privacy
Official at [email protected] for inquires related to use of ComPsych’s website or Movis AG
for inquiries related to services provided in Switzerland at [email protected].

Links to Other Services or Websites

Company’s Services may contain links to third party services or websites. We are not responsible for the
way in which these third parties handle your Personal Data. We advise you to read the privacy notice of
the third party when you make use of their service or visit their website in order to understand how this
third party collects and uses your Personal Data.

How we protect your Personal Data

We have implemented physical, technical and organizational measures to protect your Personal Data as
required by applicable laws. These measures are aimed at ensuring the integrity and confidentiality of your Personal Data, for instance by ensuring that only authorised employees have access to your Personal
Data, and to protect it against unlawful or unauthorized destruction, loss, alteration, use or disclosure, or
access. We evaluate and update these measures on a regular basis. Please be aware that no information
system can be 100% secure. This means that we cannot guarantee the absolute security or availability of
your Personal Data.

When using our web-based Services, you acquire these Services directly from Company, who offers them
from the United States. By interacting with these web-based Services you choose to share your Personal
Data to be stored or otherwise processed in servers and databases located in the United States. We always process your Personal Data in line with this Notice. As an extra security measure, we are also certified under the Swiss-U.S. Data Privacy Framework.

When using Services provided by our Global Partner in Switzerland, Movis AG, your Personal Data will be
stored or otherwise processed in the servers and databases located Switzerland.

If you require more information on the appropriate security measures in place, please contact ComPsych’s
Privacy Official via [email protected] for information related to use of ComPsych’s webbased Services or Movis AG via [email protected] for Services received in Switzerland.

In the unlikely event of a data breach that is likely to result in a high risk to your personal or fundamental
rights, Company will inform you and the Federal Data Protection and Information Commissioner (FDPIC)
of this breach in accordance with the FADP.

Company may revise this Notice to ensure compliance with applicable law and regulatory guidance at any
time. We advise you to consult this Notice regularly when using our services. To the extent required by
applicable laws, we will notify you of material changes made to this Notice. Revised notices will be posted
on our website.